Description
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
Recommendation
Update the sockjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.0
- Patched version(s): 0.3.0
References
- GHSA-hh8v-jmh3-9437
- snyk.io
- www.sockjs.org
- www.npmjs.com
- CVE-2020-8823
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Angular vulnerable to Cross-site Scripting - CVE-2020-7676
- Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter - CVE-2020-19698
- Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware - CVE-2013-7371
- Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter - CVE-2020-19697
You might also like:
- Tags:
- npm
- sockjs
Anything's wrong? Let us know Last updated on February 01, 2023